<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">You can see how the Unicon service does this at [1], but as stated, this isn’t tied into the default flow, though it’s not too difficult to add it in and do something with.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">[1]: [<a href="https://github.com/Unicon/shib-mfa-duo-auth/blob/master/src/main/groovy/net/unicon/iam/shibboleth/idp/authn/duo/authn/DuoAuthenticationService.groovy#L55-L72">https://github.com/Unicon/shib-mfa-duo-auth/blob/master/src/main/groovy/net/unicon/iam/shibboleth/idp/authn/duo/authn/DuoAuthenticationService.groovy#L55-L72</a>]</div> <br> <div id="bloop_sign_1471980640569003008" class="bloop_sign"><div style="font-family:helvetica,arial;font-size:13px">-Jj</div></div> <br><p class="airmail_on">On August 23, 2016 at 14:07:19, Rich Graves (<a href="mailto:rgraves@carleton.edu">rgraves@carleton.edu</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">Not entirely sure what you're asking, so a variety
of answers to a variety of questions:
<div><br></div>
<div>Yes, if you're using Duo's Java API you can do a preauth
check, see </div>
<div><a href="https://github.com/duosecurity/duo_shibboleth/blob/master/v3/DuoShibboleth/src/main/java/com/duosecurity/integrations/DuoShibboleth.java">
https://github.com/duosecurity/duo_shibboleth/blob/master/v3/DuoShibboleth/src/main/java/com/duosecurity/integrations/DuoShibboleth.java</a><br>
</div>
<div><br></div>
<div>Yes, the low-level /preauth REST API call is documented
at <a href="https://duo.com/docs/authapi#/preauth">https://duo.com/docs/authapi#/preauth</a>
and it does *not* require admin API privilege.</div>
<div><br></div>
<div>No, version 1.0.1 of Unicon's shib-mfa-duo-auth does not do
this, but you could check out a bleeding edge branch. I have not
looked at Scott's interim implementation or 3.3.</div>
</div>
--
<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</div></div></span></blockquote></body></html>